[oracle-l] Re: Hello

From: <bulbultyagi_at_now-india.net.in>
Date: Tue, 27 Jan 2004 13:00:28 +0530
Message-ID: <002901c3e4a7$79f497d0$0100000a@satan>

This looks like the Novarg worm
What say people ?
If yes, then thank you Listguru for filtering out the binaries

W32.Novarg.A_at_mm is a mass-mailing worm. The worm will arrive as an attachment with a file extension of .bat, .cmd, .exe, .pif, .scr, or .zip.

When the machine gets infected, the worm will set up a backdoor into the system by opening TCP ports 3127 thru 3198. This will potentially allow a hacker to connect to the machine and utilize it as a proxy to gain access to it's network resources. In addition, the backdoor has the ability to download and execute arbitrary files.

The worm will perform a DoS starting on February 1, 2004. On February 12, 2004 the worm has a trigger date to stop spreading.

• Original Message ----- From: <eca_at_siteplanet.com.br> To: "Multiple recipients of list ORACLE-L" <ORACLE-L_at_fatcity.com> Sent: Tuesday, January 27, 2004 04:04 Subject: Hello

>
>
>

---

Please see the official ORACLE-L FAQ: http://www.orafaq.com

---

To unsubscribe send email to: oracle-l-request_at_freelists.org put 'unsubscribe' in the subject line.

---

Received on Tue Jan 27 2004 - 01:30:28 CST